💡 DNS Insights

Zone-wide views of how .dk domains are set up

Zone-wide views of how .dk domains are really set up, built from our own scans: DNSSEC algorithms and NSEC3, certificate authorities, mail platforms and their security, SPF errors, web hosting, nameserver resilience, parked domains and SOA conventions. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.

DNSSEC Algorithms

Which signing algorithms .dk zones use, per DNS provider, and zones still on algorithms that must no longer be used

Authenticated denial (NSEC vs NSEC3), RFC 9276 iteration compliance and automated key rollover (CDS/CDNSKEY)

Certificate Authorities

Which CAs .dk domains authorise in CAA

Mail Platforms & Security

Microsoft 365, Google, one.com and more, with SPF, DMARC, MTA-STS, DANE and DKIM per platform

Broken and risky SPF records across the zone: +all, too many DNS lookups, void includes

Web Hosting & Dangling www

Where www points (Shopify, Wix, Squarespace …), dangling CNAMEs open to takeover, and wildcard zones

Nameserver Resilience

Domains whose DNS hangs on a single nameserver, address, network or AS

Newcomer Quality

Do newly registered domains start with DNSSEC, IPv6, SPF and DMARC? Per registrar

How much of the zone is parked, and with which parking services

Most Active Zones

The zones whose DNS changes most often

SOA Serials & Timers

Serial formats (date, Unix time, counter) and SOA timers against RFC 1912

dhd.dk [/] search Domains, Hosts & DNS — .dk zone